
JAM: JOIN-ACCUMULATE MACHINE DRAFT 0.3.4
∆
August 10, 2024 7
We denote modulo subscription as s[i]
↺
≡ s[i % s].
We denote the nal element x of a sequence s = [..., x]
through the function last(s)≡ x.
3.7.1. Construction. We may wish to dene a sequence
in terms of incremental subscripts of other values:
[x
0
, x
1
, . . . ]
n
denotes a sequence of n values beginning
x
0
continuing up to x
n−1
. Furthermore, we may also
wish to dene a sequence as elements each of which
are a function of their index i; in this case we denote
[f(i) i <
−
N
n
] ≡ [f (0), f (1), . . . , f (n − 1)]. Thus, when
the ordering of elements matters we use <
−
rather than
the unordered notation ∈. The latter may also be written
in short form [f (i <
−
N
n
)]. This applies to any set which
has an unambiguous ordering, particularly sequences, thus
[i
2
i <
−
[1, 2, 3]] = [1, 4, 9]. Multiple sequences may be
combined, thus [i ⋅ j i <
−
[1, 2, 3], j <
−
[2, 3, 4]]= [2, 6, 12].
We use explicit notation f
#
to denote a function map-
ping over all items of a sequence. Thus given some func-
tion y = f (x):
(11) [f(x
0
), f (x
1
), . . . ]= f
#
([x
0
, x
1
, . . . ])
Sequences may be constructed from sets or other se-
quences whose order should be ignored through sequence
ordering notation [i
k
i ∈ X], which is dened to result
in the set or sequence of its argument except that all ele-
ments i are placed in ascending order of the corresponding
value i
k
.
The key component may be elided in which case it is as-
sumed to be ordered by the elements directly; i.e. [i ∈ X]≡
[i
i ∈ X]. [i
k
i ∈ X] does the same, but excludes any
duplicate values of i. E.g. assuming s = [1, 3, 2, 3], then
[i
i ∈ s]= [1, 2, 3] and [−i
i ∈ s]= [3, 3, 2, 1].
Sets may be constructed from sequences with the reg-
ular set construction syntax, e.g. assuming s = [1, 2, 3, 1],
then {a a ∈ s} would be equivalent to {1, 2, 3}.
Sequences of values which themselves have a dened
ordering have an implied ordering akin to a regular dic-
tionary, thus [1, 2, 3]< [1, 2, 4] and [1, 2, 3]< [1, 2, 3, 1].
3.7.2. Editing. We dene the sequence concatenation op-
erator ⌢ such that [x
0
, x
1
, . . . , y
0
, y
1
, . . . ] ≡ x ⌢ y. For
sequences of sequences, we dene a unary concatenate-all
operator:
x ≡ x
0
⌢ x
1
⌢ . . . . Further, we denote ele-
ment concatenation as x i ≡ x ⌢ [i]. We denote the
sequence made up of the rst n elements of sequence s to
be
Ð→
s
n
≡ [s
0
, s
1
, . . . , s
n−1
], and only the nal elements as
←Ð
s
n
.
We dene
T
x as the transposition of the sequence-of-
sequences x, fully dened in equation 316. We may also
apply this to sequences-of-tuples to yield a tuple of se-
quences.
We denote sequence subtraction with a slight modica-
tion of the set subtraction operator; specically, some se-
quence s excepting the left-most element equal to v would
be denoted s m {v}.
3.7.3. Boolean values. B
s
denotes the set of Boolean
strings of length s, thus B
s
= {, ⊺}
s
. When dealing
with Boolean values we may assume an implicit equiva-
lence mapping to a bit whereby ⊺ = 1 and = 0, thus
B
◻
= N
2
◻
. We use the function bits(Y) ∈ B to de-
note the sequence of bits, ordered with the least signif-
icant rst, which represent the octet sequence Y, thus
bits([5, 0])= [1, 0, 1, 0, 0, . . . ].
3.7.4. Octets and Blobs. Y denotes the set of octet strings
(“blobs”) of arbitrary length. As might be expected, Y
x
denotes the set of such sequences of length x. Y
$
denotes
the subset of Y which are ASCII-encoded strings. Note
that while an octet has an implicit and obvious bijec-
tive relationship with natural numbers less than 256, and
we may implicitly coerce between octet form and natural
number form, we do not treat them as exactly equivalent
entities. In particular for the purpose of serialization, an
octet is always serialized to itself, whereas a natural num-
ber may be serialized as a sequence of potentially several
octets, depending on its magnitude and the encoding vari-
ant.
3.7.5. Shuing. We dene the sequence-shue function
F, originally introduced by sheryates1938statistical,
with an ecient in-place algorithm described by
wikipedia2024sheryates. This accepts a sequence and
some entropy and returns a sequence of the same length
with the same elements but in an order determined by the
entropy. The entropy may be provided as either an indef-
inite sequence of naturals or a hash. For a full denition
see appendix F.
3.8. Cryptography.
3.8.1. Hashing. H denotes the set of 256-bit values typi-
cally expected to be arrived at through a cryptographic
function, equivalent to Y
32
, with H
0
being equal to
[0]
32
. We assume a function H(m ∈ Y) ∈ H denoting
the Blake2b 256-bit hash introduced by rfc7693 and a
function H
K
(m ∈ Y) ∈ H denoting the Keccak 256-bit
hash as proposed by bertoni2013keccak and utilized by
wood2014ethereum.
We may sometimes wish to take only the rst x octets
of a hash, in which case we denote H
x
(m)∈ Y
x
to be the
rst x octets of H(m). The inputs of a hash function are
generally assumed to be serialized with our codec E(x)∈ Y,
however for the purposes of clarity or unambiguity we may
also explicitly denote the serialization. Similarly, we may
wish to interpret a sequence of octets as some other kind
of value with the assumed decoder function E
−1
(x ∈ Y). In
both cases, we may subscript the transformation function
with the number of octets we expect the octet sequence
term to have. Thus, r = E
4
(x ∈ N) would assert x ∈ N
2
32
and r ∈ Y
4
, whereas s = E
−1
8
(y) would assert y ∈ Y
8
and
s ∈ N
2
64
.
3.8.2. Signing Schemes. E
k
m ⊂ Y
64
is the set of valid
Ed25519 signatures, dened by rfc8032, made through
knowledge of a secret key whose public key counterpart is
k ∈ Y
32
and whose message is m. To aid readability, we
denote the set of valid public keys k ∈ H
E
.
We use Y
BLS
⊂ Y
144
to denote the set of public keys for
the bls signature scheme, described by jofc-2004-14130,
on curve bls12-381 dened by bls12-381.
We denote the set of valid Bandersnatch public keys as
H
B
, dened in appendix G. F
m∈Y
k∈H
B
x ∈ Y⊂ Y
96
is the set
of valid singly-contextualized signatures of utilizing the se-
cret counterpart to the public key k, some context x and
message m.
¯
F
m∈Y
r∈Y
R
x ∈ Y⊂ Y
784
, meanwhile, is the set of valid Ban-
dersnatch Ringvrf deterministic singly-contextualized
proofs of knowledge of a secret within some set of secrets
identied by some root in the set of valid roots Y
R
⊂ Y
144
.